Thunderbird Client :: Inbox Wipedout during NOD32 Scan :: HELP!

I spent all day yesterday trying to carefully recover my system after NOD32 V3 found 3 false positives yesterday, some included the Adobe files which a lot of users reported. Between removing V3 and restoring Windows to an older restore point I was able to stop the crashing that kept ocurring on my DELL Precision 670.

I had to revert back to NOD32 V2.7 with the latest updates and immediately after I did that I tried to run a full scan to make sure there were no real threats in my system.

Please read what I posted on the Thunderbird Forum:

So I got home and started to check my email. At the same time NOD32 V2.7 (my antivirus app.) began a full scan of my system.

As I was looking through my different folders and such I suddenly noticed that months worth of emails that I needed to follow up on were GONE from the inbox.
I checked NOD32's scan log and found something that may help me try to recover my emails, I need your help though!!

I check my deleted files on the recycle bin, nothing related is there, I checked the QUARANTINE on NOD32, its empty.

I tried to follow some of the actions recommended in the Knowledge Base and nothing worked.

• I tried to Rebuild the index on the inbox. Nothing.
• I tried to rename the inbox.msf file and restart Thunderbird. Nothing.
• I tried to delete the panacea file. Nothing.

While looking under C:\Documents and Settings\user\Application Data\Thunderbird\Profiles\gk9bjamf.default\Mail\mail.domain.com after the emails dissapeared
I had an "inbox" file that was 2KB in size, while the inbox.sfm was 0KB, but I know that the messages that were stored in that inbox were a few MB in size...

I also have an Inbox.sbd folder which is empty...

I have no idea where to go from here and I am afraid I may have lost these important emails by looking at that 0KB size file.

What else can I try?

I have disabled compacting for the time being just to make sure the messages don't get deleted for good if they are still swimming around somewhere....!

First of all, I think you got the access denied error because you had Thunderbird open while you were scanning.

Second, is there a chance your profile is elsewhere? It sounds to me as though your Thunderbird is now opening a new profile, and the other one is elsewhere on the computer. Have you searched the entire computer for "inbox" or "sent" or *.msf files? Restrict the search to files modified within the last week and it should narrow it down. It's possible they are in some temp folder. Make sure you search for hidden files while you're at it.

Storing all emails in a single file, as MS Outlook and Thunderbird and most other clients do, leaves you vulnerable to file corruption or whatever. I migrated to Becky! Internet Email for this reason, among others - I now have thousands of emails all stored as individual files - if I lose one I don't lose the lot. And Becky runs like lightning. Others have spoken of having 70,000 emails in a folder without affecting Becky's speed.

I hope you find your emails. If you do, and you decide to stick with Thunderbird, make sure you at least create multiple subfolders for your email - it reduces the size of each file and helps prevent a crash.

The files listed in "C:\Documents and Settings\*user*\Application Data\Thunderbird\Profiles\*your-default-profile.xxxxx*\Mail\mail.domain.com" are usualy very small in size,

If you want your main mail files they will be in "C:\Documents and Settings\*user*\Application Data\Thunderbird\Profiles\*your-default-profile.xxxxx*\Mail\Local Folders"

Also are you sure they have not been archived, or possibly in your account settings the "delete after x amount of days" is set.

And I do have to ask this question, why on earth if your email data is so critical, have you no backups?
I would like to offer a bit of advice for the future, backup - save - and NEVER let any program auto delete/quarantine anything, you should always have control. Pointing the blame finger at someone for a problem that could have been avoided and easily remedied will always point 4 fingers back at you.

You could try opening the run command and typing in "thunderbird -p" to open up the profile editor, you may have a newly created profile running.
Anyway, I hope you find your mail... good luck

First of all, I think you got the access denied error because you had Thunderbird open while you were scanning.

Click to expand...

You guess right... but still!!!

Gez said:

Second, is there a chance your profile is elsewhere? It sounds to me as though your Thunderbird is now opening a new profile, and the other one is elsewhere on the computer. Have you searched the entire computer for "inbox" or "sent" or *.msf files? Restrict the search to files modified within the last week and it should narrow it down. It's possible they are in some temp folder. Make sure you search for hidden files while you're at it.
Storing all emails in a single file, as MS Outlook and Thunderbird and most other clients do, leaves you vulnerable to file corruption or whatever.

Click to expand...

Check. Nothing found. Hidden files are always exposed in my systems.
Thunderbird is setup to cope with potential antivirus issues to prevent the whole inbox being quarantined. However in this case the inbox was neither quarantined, nor deleted. It was simply "corrupted" if you can call a file with several megs of data that turns into 2KB of data "corrupted"...

Gez said:

I hope you find your emails. If you do, and you decide to stick with Thunderbird, make sure you at least create multiple subfolders for your email - it reduces the size of each file and helps prevent a crash.

Click to expand...

Thank you. I am a pack rat when it comes to most things, including my email... I have LOTS of FOLDERS anally organized, but emails that I NEED to follow up on stay on my inbox, this time my inbox took the hit.

The files listed in "C:\Documents and Settings\*user*\Application Data\Thunderbird\Profiles\*your-default-profile.xxxxx*\Mail\mail.domain.com" are usualy very small in size,

If you want your main mail files they will be in "C:\Documents and Settings\*user*\Application Data\Thunderbird\Profiles\*your-default-profile.xxxxx*\Mail\Local Folders"

Click to expand...

Thank You!!! Checking it after I reply!!! I got my fingers crossed!

MaVRiC said:

Also are you sure they have not been archived, or possibly in your account settings the "delete after x amount of days" is set.

Click to expand...

I am sure.

MaVRiC said:

And I do have to ask this question, why on earth if your email data is so critical, have you no backups?

Click to expand...

Absolutely, I am always telling my clients and such to BACKUP! I have a dedicated HD backup system that I run with Restrospect, but unfortunately I have not backed up in weeks due to a problem I encountered. Long story...
That part I take responsibility for (if it was a virus) but I point fingers at the program that does damage or has a bug... and RIGHTLY so!!! Backup or not, this should not happen to anybody!!!

MaVRiC said:

I would like to offer a bit of advice for the future, backup - save - and NEVER let any program auto delete/quarantine anything, you should always have control. Pointing the blame finger at someone for a problem that could have been avoided and easily remedied will always point 4 fingers back at you.

Click to expand...

^ see previous.

MaVRiC said:

You could try opening the run command and typing in "thunderbird -p" to open up the profile editor, you may have a newly created profile running.
Anyway, I hope you find your mail... good luck

So, once I spot some .MSF files to interact with (or would I be looking for the one's with no extension?). How do I open them to check for my mail messages?
Thank you!

Click to expand...

It's the files without the extension you need. Inbox, for example, not inbox.msf.
If TB won't import them then use another client to do so - the trial version of Becky will import TB mailboxes and export them once again as Unix mailboxes. There are plenty of mail clients out there that will do the same - Sylpheed, Claws Mail, Foxmail, The Bat. Once you've exported them as Unix mailboxes TB should be able to import them again.
My opinion is that it's not necessarily the case Nod32 caused your original problem; it's just as likely TB did. I had some issues with TB mailboxes when I tried it that turned me off the program. And indeed, as I've already said to you, I don't like have all my eggs in one basket, and all my emails in one file, especially if something as basic as a virus scan corrupts it so easily.